Analysis
-
max time kernel
145s -
max time network
132s -
platform
windows10_x64 -
resource
win10 -
submitted
13-07-2020 11:20
Static task
static1
Behavioral task
behavioral1
Sample
R220917549.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
R220917549.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
R220917549.exe
-
Size
923KB
-
MD5
65e707bd6d53922eed2f27b35bd5355a
-
SHA1
8e2cb2687357567045584ed5cb36c11cc928f4a4
-
SHA256
ca2474c82643817c50106479f991ae282b9bb24fde98721dc5f99fe9a5eb3300
-
SHA512
606f8a9fab4b19fc43ed233f62fcefc3758e1e8fd6358b9fecbd8a3e3a43027ddded905ad2fc185eec7c3e14c1ad563ce007cb35f61797846807757b2ac1447a
Score
10/10
Malware Config
Signatures
-
Suspicious behavior: EnumeratesProcesses 62 IoCs
pid Process 4092 R220917549.exe 4092 R220917549.exe 2924 R220917549.exe 2924 R220917549.exe 2924 R220917549.exe 2924 R220917549.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe 3836 control.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Key created \Registry\Machine\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run control.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ZVUDWTWH4 = "C:\\Program Files (x86)\\To4nh3j_\\sj1h2d4pl.exe" control.exe -
description ioc Process Key created \Registry\User\S-1-5-21-2066881839-3229799743-3576549721-1000\SOFTWARE\Microsoft\Internet Explorer\IntelliForms\Storage2 control.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 4092 wrote to memory of 2924 4092 R220917549.exe 67 PID 4092 wrote to memory of 2924 4092 R220917549.exe 67 PID 4092 wrote to memory of 2924 4092 R220917549.exe 67 PID 2996 wrote to memory of 3836 2996 Explorer.EXE 68 PID 2996 wrote to memory of 3836 2996 Explorer.EXE 68 PID 2996 wrote to memory of 3836 2996 Explorer.EXE 68 PID 3836 wrote to memory of 3852 3836 control.exe 69 PID 3836 wrote to memory of 3852 3836 control.exe 69 PID 3836 wrote to memory of 3852 3836 control.exe 69 PID 3836 wrote to memory of 1716 3836 control.exe 77 PID 3836 wrote to memory of 1716 3836 control.exe 77 PID 3836 wrote to memory of 1716 3836 control.exe 77 -
Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 4092 R220917549.exe 2924 R220917549.exe 2924 R220917549.exe 2924 R220917549.exe 3836 control.exe 3836 control.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4092 set thread context of 2924 4092 R220917549.exe 67 PID 2924 set thread context of 2996 2924 R220917549.exe 56 PID 3836 set thread context of 2996 3836 control.exe 56 -
Suspicious use of AdjustPrivilegeToken 10 IoCs
description pid Process Token: SeDebugPrivilege 2924 R220917549.exe Token: SeDebugPrivilege 3836 control.exe Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE Token: SeShutdownPrivilege 2996 Explorer.EXE Token: SeCreatePagefilePrivilege 2996 Explorer.EXE -
Drops file in Program Files directory 1 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\To4nh3j_\sj1h2d4pl.exe control.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2996 -
C:\Users\Admin\AppData\Local\Temp\R220917549.exe"C:\Users\Admin\AppData\Local\Temp\R220917549.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
PID:4092 -
C:\Users\Admin\AppData\Local\Temp\R220917549.exe"C:\Users\Admin\AppData\Local\Temp\R220917549.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
PID:2924
-
-
-
C:\Windows\SysWOW64\control.exe"C:\Windows\SysWOW64\control.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Modifies Internet Explorer settings
- Suspicious use of WriteProcessMemory
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Drops file in Program Files directory
PID:3836 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\R220917549.exe"3⤵PID:3852
-
-
C:\Windows\SysWOW64\cmd.exe/c copy "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Login Data" "C:\Users\Admin\AppData\Local\Temp\DB1" /V3⤵PID:1716
-
-